Summary | ZeroBOX

M0031.cab

KeyLogger Escalate priviledges AntiDebug AntiVM
Category Machine Started Completed
FILE s1_win7_x6402 July 27, 2021, 11:49 a.m. July 27, 2021, 11:51 a.m.
Size 1.2MB
Type Microsoft Cabinet archive data, 1300257 bytes, 3 files
MD5 beb963a9b929bf9617af474087e9f848
SHA256 46f0d364accf5c743467aa0071b4cb698f7c43178f13710c333803ae30adfd8d
CRC32 0C1650E0
ssdeep 24576:JnyhYkkpRKO2vG8ievGpNAkt6SDMdVXOPdlvvU0mkpoL416Aic9nMXzmZ3:JnWfqZ2+C8NAkt67kdlv+kpoLTAieMX4
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d52000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71eb3000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeRestorePrivilege
1 1 0
description Escalate priviledges rule Escalate_priviledges
description Run a KeyLogger rule KeyLogger
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep